I2C Bug in STM32CubeF2 Firmware Package V1.4.0

[christian239955_stm1_stmicro]

Posted on December 05, 2016 at 17:45

Hi folks,

my application crashes occasionally with the above mentioned firmware package when data is transmitted to I2C devices.

The crash is caused by following code in HAL_I2C_Master_Transmit:

    while(hi2c->XferSize > 0U)

    {

      /* Wait until TXE flag is set */

      if(I2C_WaitOnTXEFlagUntilTimeout(hi2c, Timeout, tickstart) != HAL_OK)

      {

           ...

      }

      /* Write data to DR */

      hi2c->Instance->DR = (*hi2c->pBuffPtr++);

      hi2c->XferCount--;

      hi2c->

XferSize

--;

      if((__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_BTF) == SET) && (

Size

!= 0U))

      {

You can get here when

I2C_FLAG_BTF

is set due to delay (interrupt) and

XferSize

== 0 because the wrong var (

Size

) is checked. This results in

XferSize

wrapping around to 0xffff. The transmit loops continues and usually the

pBuffPtr

runs beyond bounds causing a bus error.

        /* Write data to DR */

        hi2c->Instance->DR = (*hi2c->pBuffPtr++);

        hi2c->XferCount--;

hi2c->XferSize--;

      }

This code fragment can be found several times in stm32f2xx_hal_i2c.c.

I temporarily went back to Rev 1.3.0.

Christian

[Walid FTITI_O]

Posted on December 06, 2016 at 11:29

Hi

backeberg.christian

,

Thank you for the feedback and contribution. I send internally your request for check.

-Walid FTITI-

[christian239955_stm1_stmicro]

Posted on October 18, 2017 at 14:58

Hi Walid,

recently I noticed an update of stm32f2xx_hal_i2c.c to revision 1.6.

I checked it against the above mentioned bug.

It seems that the bug has not being fixed in all places were it can occur.

In HAL_I2C_Slave_Receive() at Line 1142 the old code can be found.

Christian

[Amel NASRI]

Posted on October 18, 2017 at 16:18

Hi

backeberg.christian

‌,

Thanks for highlighting this again, this will be reviewed and fixed.

-Amel

[christian239955_stm1_stmicro]

Posted on February 01, 2018 at 17:19

Sorry, but the above mentioned bug is still not fixed in Rev 1.7.0.

Line 1140:

      if((__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_BTF) == SET) && (Size != 0))

should be:

     if((__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_BTF) == SET) && (hi2c->XferSize != 0))

Greetings - Christian